nerdexam
CrowdStrike

CCFR-201B · Question #49

Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

The correct answer is A. An adversary is trying to keep access through persistence by creating an account. Adversaries may create an account to maintain access to victim systems.

MITRE ATT&CK Framework

Question

Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

Options

  • AAn adversary is trying to keep access through persistence by creating an account
  • BAn adversary is trying to keep access through persistence using browser extensions
  • CAn adversary is trying to keep access through persistence using external remote services
  • DAn adversary is trying to keep access through persistence using application skimming

How the community answered

(27 responses)
  • A
    96% (26)
  • C
    4% (1)

Explanation

Adversaries may create an account to maintain access to victim systems.

Topics

#MITRE ATT&CK#persistence#create account#Falcon detection taxonomy

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CCFR-201B Practice